Exposing Cyberthreats: How Attack Patterns Are Shaped by Network Topologies and Honeypot Techniques

As cyberattacks grow more sophisticated, it is critical to know about human engagement with network defenses. Honeypots—decoy systems that are intended to deceive attackers—have been promising, but we know little about how their performance varies with network design. With HackIT, a cybersecurity simulation tool, this paper examines attacker behavior on various network topologies (ring vs. star) and honeypot densities (50% vs. 75%). We conducted a human-subject experiment with 88 computer science students who were instructed to exploit mock networks without honeypot placement information. Outcomes showed that increased honeypot density maximized decoy interaction but also led to more real-system attacks in networks with a centralized (star) topology. Decentralized (ring) networks, however, were more robust with fewer honeypots. These findings suggest that attacker behavior reacts to perceived vulnerability and structural cues, affirming the imperative of including behavioral knowledge in cyber defense.